Protect from sql injection in php

Question

Protect from sql injection in php

Navigation

#1 by (1 votes)
#2 by (1 votes)

0

I have this code to insert:

$name = isset($_POST["DescricaoProd"]) ? $_POST["DescricaoProd"] : '';
$unid = isset($_POST["DescricaoUnid"]) ? $_POST["DescricaoUnid"] : '';
if (!empty($name) && !empty($unid)) {  
    echo 'true';
} else {
    echo 'false';
}    
$sql = "INSERT INTO ProdHigieneteste (DescricaoProd,DescricaoUnid) 
VALUES ('$name','$unid')";
if ($conn->query($sql) === TRUE);
$sql1 = "INSERT INTO StockHigieneteste (DescricaoProd,DescricaoUnid) 
VALUES ('$name','$unid')";
if ($conn->query($sql1) === TRUE);
    //Count total number of rows
    $rowCount = $query->num_rows;   
$conn->close();

I wanted to protect from sql injection, can anyone help?

php mysql

asked by anonymous 24.05.2018 / 15:27

2 answers

1

I'm not an expert on SQL Injection Protection, but I'll share a code that has helped me a lot.

function protect( &$str ) {
 /*** Função para retornar uma string/Array protegidos contra SQL/Blind/XSS Injection*/
        if( !is_array( $str ) ) {                      
                $str = preg_replace( '/(from|select|insert|delete|where|drop|union|order|update|database)/i', '', $str );
                $str = preg_replace( '/(&lt;|<)?script(\/?(&gt;|>(.*))?)/i', '', $str );
                $tbl = get_html_translation_table( HTML_ENTITIES );
                $tbl = array_flip( $tbl );
                $str = addslashes( $str );
                $str = strip_tags( $str );
                return strtr( $str, $tbl );
        } else {
                return array_filter( $str, "protect" );
        }
}

Just filter all data from $ _POST and $ _GET

24.05.2018 / 15:35

How to assign all the characteristics of one object to another, least one in particular? look for given in a json python

score 1 · Accepted Answer

Try this

//trim ignora uso de espaço antes e depois da palavra ou frase
          //strip_tags não interpreta o uso de tags dentro do input
         $nome = trim(strip_tags($_POST['nome']));
         $cronica = trim(strip_tags($_POST['cronica']));
         $sintomas = trim(strip_tags($_POST['sintoma']));
         $descri = trim(strip_tags($_POST['desc']));
         $insert = "INSERT INTO tb_doenca(nome_doenca,doenca_cronica,sintomas_doenca,desc_doenca) VALUES (:nome,:cronica,:sintomas,:descri)";

         try{
          //Proteção contra SQLINJECT
          $result = $con->prepare($insert);
          $result->bindParam(':nome',$nome,PDO::PARAM_STR);
          $result->bindParam(':cronica',$cronica,PDO::PARAM_STR);
          $result->bindParam(':sintomas',$sintomas,PDO::PARAM_STR);
          $result->bindParam(':descri',$descri,PDO::PARAM_STR);
          $result->execute();

I got a code I had before ... try to replace values